Technical Field
This disclosure relates generally to cryptographic key lifecycle management.
Background of the Related Art
Business data is growing at exponential rates, and along with that growth is a demand for securing that data. Enterprises have responded by implementing encryption at various layers, such as in hardware, on the network, and in various applications. This response has resulted in a series of encryption silos, some of which hold confidential customer data, with fragmented approaches to security, keys and coverage. Further, different applications across the enterprise often employ different encryption methods. Thus, for example, some departments in the organization may use public-key cryptography while others use secret-key or hashes. Still others do not encrypt data while it is at rest (such as when it is stored on a device or in a database) but only when the data is in motion, using virtual private networks (VPNs) to secure the data pipeline. Key management for these encryption approaches is often similarly fragmented. Sometimes key management is carried out by department teams using manual processes or embedded encryption tools. Other times, the key management function is centrally managed and executed. In some cases, no formal key management process is in place. This fragmented approach to key management can leave the door open for loss or breach of sensitive data.
Key Management Interoperability Protocol (KMIP) is a relatively new standard for key management sponsored by the Organization for the Advancement of Structured Information Standards (OASIS). It is designed as a comprehensive protocol for communication between enterprise key management servers and cryptographic clients (e.g., from a simple automated device to a sophisticated data storage system). By consolidating key management in a single key management system that is KMIP-compliant, an enterprise can reduce its operational and infrastructure costs while ensuring appropriate operational controls and governance of security policy.
While KMIP provides significant advantages, the approach (and other cryptographic key management services like it) requires users to adapt to a remote protocol for accessing the materials retained therein. This requirement often dictates that code changes be implemented on the part of the using (consuming) applications.
To enable broader use of KMIP services, it would be desirable to enable users and applications to access these (and similar types of key management) services without forcing code changes by the consuming applications.
The subject matter of this disclosure addresses this need.